REMOTE_USER authentication

[John Dennis]

On 08/31/2016 12:16 PM, Cantor, Scott wrote:
> On 8/31/16, 12:00 PM, "users on behalf of Roman CHRENKO" <users-bounces at shibboleth.net on behalf of Roman_CHRENKO at tempest.sk> wrote:
>
>> When I am trying to authenticate by HTTP header REMOTE_USER, I use my browser with Fiddler
>> proxy (with option Rules > Automatic breakpoints > Before Request and I add manually HTTP
>> header "REMOTE_USER: rchrenko" to every request) or I use my Java program, which do the
>> same.
>
> REMOTE_USER is not a header. If you want to use a header, then you have to follow the documentation and change the configuration to look for the identity in a header, and I certainly would not confuse yourself by calling it REMOTE_USER.
>
> The servlet API for getRemoteUser will only return a value established by the container, not from a header just because you happen to call it that.

I imagine this discussion is in the context of some type of proxy.

FWIW it's easy to write a filter that will allow things like 
getRemoteUser to first check for a value in an HTTP header. I'm happy to 
share the code.

However, and this is really important, stuffing things like REMOTE_USER 
into an HTTP header is a *huge* security hole unless you can guarantee 
the request originates *exclusively* from a client you trust [1]. There 
are a number of ways you can achieve this, but generally I strongly 
discourage it because you might leave a hole open or a subsequent change 
by a person that does not understand the issue makes a change that opens 
the hole. Once that happens it's game over, you effectively are wide 
open with no authentication.

Why is this a security hole? Because the presence of REMOTE_USER implies 
authentication has already successfully occurred. So all you have do 
(and it's easy) is craft a request that contains REMOTE_USER and 
authentication (in most cases) will be bypassed. Imagine 
REMOTE_USER=admin, kinda makes the hair stand up on the back of your 
neck doesn't it? :-) That's why it's essential you trust the origin of 
REMOTE_USER.

[1] The same holds true for AJP proxies that embed REMOTE_USER in the 
AJP protocol stream (which getRemoteUser will see).

-- 
John